Timeline
Process tree
What it tried
Indicators
Signs that identify this sample, for searching your own logs. Addresses are defanged, written with [.] and hxxp, so they cannot be opened by accident. These values are invented for the demo.
How we tested
Every sample goes through the same four steps, one sample at a time.
- 1
A fresh machine
Each sample gets its own new Windows 11 24H2 virtual machine, sealed off from every other machine. Malphas 1.2.6 is installed with its default settings.
- 2
No way out
The network is sinkholed: every connection the sample makes is answered by a stand-in server of ours, so nothing it sends reaches the internet.
- 3
Opened like a person would
The sample, taken from public malware repositories, is opened the way a person would open it. For ten minutes we record every program it starts and every file, registry and network change it attempts.
- 4
Wiped afterwards
When the ten minutes are up, the machine is restored from a snapshot taken before the sample arrived, so nothing carries over to the next one.
This page shows demo data. The lab has not published its results yet, so the numbers, times and indicators here are examples of what each report will contain.
Downloads
The raw records behind this report. They will be available when the lab publishes.